CWE-444
AllowedInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Abstraction: Base · Status: Incomplete
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
613 vulnerabilities reference this CWE, most recent first.
GHSA-PXP2-GJPV-XJRC
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vulnerability to cause information leak. Affected product versions include: CampusInsight versions V100R019C10; ManageOne versions 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1, 6.5.1RC2, 8.0.RC2. Affected product versions include: Taurus-AL00A versions 10.0.0.1(C00E1R1P1).
{
"affected": [],
"aliases": [
"CVE-2021-22293"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-06T03:15:00Z",
"severity": "HIGH"
},
"details": "Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vulnerability to cause information leak. Affected product versions include: CampusInsight versions V100R019C10; ManageOne versions 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1, 6.5.1RC2, 8.0.RC2. Affected product versions include: Taurus-AL00A versions 10.0.0.1(C00E1R1P1).",
"id": "GHSA-pxp2-gjpv-xjrc",
"modified": "2022-05-24T17:41:14Z",
"published": "2022-05-24T17:41:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22293"
},
{
"type": "WEB",
"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210120-01-http-en"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q3G2-M552-3R9C
Vulnerability from github – Published: 2026-07-24 21:52 – Updated: 2026-07-24 21:52Summary
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting.
Impact
Two related gaps in inbound header validation, against any application using HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an HTTP/1.1 backend:
Regular header field values were only checked against a forbidden-name
list (connection, transfer-encoding, proxy-connection, keep-alive,
upgrade); the value itself was never inspected. An attacker-controlled
regular header field value containing CR or LF passed validation and, once
serialized as name: value CRLF by the codec, terminated the field early
and injected extra header lines into the outbound HTTP/1.1 message.
Pseudo-header values (:path in particular) were only checked against
CR, LF and NUL. A :path value containing SP serializes into the
request-target of METHOD SP request-target SP HTTP-version CRLF, so a
value like /a HTTP/1.1 produces GET /a HTTP/1.1 HTTP/1.1 — a
parser-differential request line depending on whether a downstream reader
takes the first or last SP-delimited token as the version.
Neither of these is reachable on a stock pipeline: NIOHTTP1's outbound
validator (enableOutboundHeaderValidation, on by default) already rejects
these characters on write. The exposure is pipelines that skip outbound
validation, or any code that reads validated-looking HTTPRequestHead.headers
and forwards the values on trusting that HTTP/2 already checked them.
Fix
Fixed in 48bfd90 and 45bdf67.
Mitigation
Upgrade to 1.45.0
{
"affected": [
{
"package": {
"ecosystem": "SwiftURL",
"name": "swift-nio-http2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.45.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-64785"
],
"database_specific": {
"cwe_ids": [
"CWE-113",
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T21:52:10Z",
"nvd_published_at": "2026-07-23T20:17:21Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nSwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let\nCR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend\nthrough NIOHTTP2\u0027s HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling\nor response splitting.\n\n## Impact\n\nTwo related gaps in inbound header validation, against any application\nusing HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an\nHTTP/1.1 backend:\n\nRegular header field values were only checked against a forbidden-name\nlist (connection, transfer-encoding, proxy-connection, keep-alive,\nupgrade); the value itself was never inspected. An attacker-controlled\nregular header field value containing CR or LF passed validation and, once\nserialized as `name: value CRLF` by the codec, terminated the field early\nand injected extra header lines into the outbound HTTP/1.1 message.\n\nPseudo-header values (`:path` in particular) were only checked against\nCR, LF and NUL. A `:path` value containing SP serializes into the\nrequest-target of `METHOD SP request-target SP HTTP-version CRLF`, so a\nvalue like `/a HTTP/1.1` produces `GET /a HTTP/1.1 HTTP/1.1` \u2014 a\nparser-differential request line depending on whether a downstream reader\ntakes the first or last SP-delimited token as the version.\n\nNeither of these is reachable on a stock pipeline: NIOHTTP1\u0027s outbound\nvalidator (`enableOutboundHeaderValidation`, on by default) already rejects\nthese characters on write. The exposure is pipelines that skip outbound\nvalidation, or any code that reads validated-looking `HTTPRequestHead.headers`\nand forwards the values on trusting that HTTP/2 already checked them.\n\n## Fix\n\nFixed in 48bfd90 and 45bdf67.\n\n## Mitigation\n\nUpgrade to 1.45.0",
"id": "GHSA-q3g2-m552-3r9c",
"modified": "2026-07-24T21:52:10Z",
"published": "2026-07-24T21:52:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64785"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/commit/45bdf670248be5f16ec0340e125dca285536f0fb"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/commit/48bfd9067d7d1d15c4789440127a0cf36222ea43"
},
{
"type": "PACKAGE",
"url": "https://github.com/apple/swift-nio-http2"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/releases/tag/1.45.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "swift-nio-http2: Missing CR/LF/NUL validation in header values"
}
GHSA-Q3J3-W37X-HQ2Q
Vulnerability from github – Published: 2021-11-24 20:04 – Updated: 2024-02-05 11:13Description
When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the X-Forwarded-* HTTP headers. HTTP headers that are not part of the "trusted_headers" allowed list are ignored and protect you from "Cache poisoning" attacks.
In Symfony 5.2, we've added support for the X-Forwarded-Prefix header, but this header was accessible in sub-requests, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a X-Forwarded-Prefix HTTP header, leading to a web cache poisoning issue.
Resolution
Symfony now ensures that the X-Forwarded-Prefix HTTP header is not forwarded to sub-requests when it is not trusted.
The patch for this issue is available here for branch 5.3.
Credits
We would like to thank Soner Sayakci for reporting the issue and Jérémy Derussé for fixing the issue.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/http-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.3.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.3.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-41267"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-24T19:58:05Z",
"nvd_published_at": "2021-11-24T19:15:00Z",
"severity": "MODERATE"
},
"details": "Description\n-----------\n\nWhen a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the `X-Forwarded-*` HTTP headers. HTTP headers that are not part of the \"trusted_headers\" allowed list are ignored and protect you from \"Cache poisoning\" attacks. \n\nIn Symfony 5.2, we\u0027ve added support for the `X-Forwarded-Prefix` header, but this header was accessible in sub-requests, even if it was not part of the \"trusted_headers\" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` HTTP header, leading to a web cache poisoning issue.\n\nResolution\n----------\n\nSymfony now ensures that the `X-Forwarded-Prefix` HTTP header is not forwarded to sub-requests when it is not trusted.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487) for branch 5.3.\n\nCredits\n-------\n\nWe would like to thank Soner Sayakci for reporting the issue and J\u00e9r\u00e9my Deruss\u00e9 for fixing the issue.\n",
"id": "GHSA-q3j3-w37x-hq2q",
"modified": "2024-02-05T11:13:47Z",
"published": "2021-11-24T20:04:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41267"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/pull/44243"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2021-41267.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-41267.yaml"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/releases/tag/v5.3.12"
},
{
"type": "WEB",
"url": "https://symfony.com/cve-2021-41267"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Webcache Poisoning in symfony/http-kernel"
}
GHSA-Q3QJ-89J7-F5FH
Vulnerability from github – Published: 2024-02-17 03:30 – Updated: 2024-02-17 03:30Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
{
"affected": [],
"aliases": [
"CVE-2024-20915"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-17T02:15:46Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).",
"id": "GHSA-q3qj-89j7-f5fh",
"modified": "2024-02-17T03:30:29Z",
"published": "2024-02-17T03:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20915"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2024.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-Q578-5VF7-89MR
Vulnerability from github – Published: 2026-05-26 18:31 – Updated: 2026-05-27 15:33IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to denial of service and a potential remote code execution due to improper input validation.
{
"affected": [],
"aliases": [
"CVE-2026-9170"
],
"database_specific": {
"cwe_ids": [
"CWE-444",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-26T18:16:57Z",
"severity": "HIGH"
},
"details": "IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to denial of service and a potential remote code execution due to improper input validation.",
"id": "GHSA-q578-5vf7-89mr",
"modified": "2026-05-27T15:33:00Z",
"published": "2026-05-26T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9170"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7274065"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7274072"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5VX-44V4-GCH4
Vulnerability from github – Published: 2022-07-15 00:00 – Updated: 2023-07-11 00:18The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "llhttp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-32214"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-11T00:18:17Z",
"nvd_published_at": "2022-07-14T15:15:00Z",
"severity": "CRITICAL"
},
"details": "The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).",
"id": "GHSA-q5vx-44v4-gch4",
"modified": "2023-07-11T00:18:17Z",
"published": "2022-07-15T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32214"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/llhttp/commit/18a4afc7ffb4e49dc9e2daebc50588199a6d1dbb"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1524692"
},
{
"type": "WEB",
"url": "https://datatracker.ietf.org/doc/html/rfc7230#section-3"
},
{
"type": "WEB",
"url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220915-0001"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5326"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields"
}
GHSA-Q677-7PJP-5HQ5
Vulnerability from github – Published: 2024-08-20 18:31 – Updated: 2024-11-18 16:27The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
{
"affected": [],
"aliases": [
"CVE-2024-27185"
],
"database_specific": {
"cwe_ids": [
"CWE-349",
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-20T16:15:10Z",
"severity": "MODERATE"
},
"details": "The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.",
"id": "GHSA-q677-7pjp-5hq5",
"modified": "2024-11-18T16:27:06Z",
"published": "2024-08-20T18:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27185"
},
{
"type": "WEB",
"url": "https://developer.joomla.org/security-centre/942-20240802-core-cache-poisoning-in-pagination.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:Clear",
"type": "CVSS_V4"
}
]
}
GHSA-Q68P-H2V7-5W73
Vulnerability from github – Published: 2023-10-09 18:30 – Updated: 2024-04-04 08:26HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2023-30910"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-09T16:15:10Z",
"severity": "MODERATE"
},
"details": "HPE MSA Controller prior to version\u00a0IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.\u00a0",
"id": "GHSA-q68p-h2v7-5w73",
"modified": "2024-04-04T08:26:20Z",
"published": "2023-10-09T18:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30910"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbst04539en_us"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q77P-J5GJ-RMW2
Vulnerability from github – Published: 2024-10-15 21:30 – Updated: 2024-10-16 21:31An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service(DoS) via a crafted request.
{
"affected": [],
"aliases": [
"CVE-2024-44775"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-15T21:15:10Z",
"severity": "HIGH"
},
"details": "An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service(DoS) via a crafted request.",
"id": "GHSA-q77p-j5gj-rmw2",
"modified": "2024-10-16T21:31:08Z",
"published": "2024-10-15T21:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44775"
},
{
"type": "WEB",
"url": "https://gist.github.com/pengwGit/26fd8630392af5d8829c2e220091ac4f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q7JF-GF43-6X6P
Vulnerability from github – Published: 2025-10-24 19:15 – Updated: 2025-11-27 08:51Summary
A flaw in the CORS middleware allowed request Vary headers to be reflected into the response, enabling attacker-controlled Vary values and potentially affecting cache behavior.
Details
The middleware previously copied the Vary header from the request when origin was not set to "*". Since Vary is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling.
Most environments will see impact only when shared caches or proxies rely on the Vary header. The practical effect varies by configuration.
Impact
May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations.
Resolution
Update to the latest patched release. The CORS middleware has been corrected to handle Vary exclusively as a response header.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hono"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.10.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-24T19:15:13Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary \nA flaw in the CORS middleware allowed request `Vary` headers to be reflected into the response, enabling attacker-controlled `Vary` values and potentially affecting cache behavior.\n\n### Details \nThe middleware previously copied the `Vary` header from the request when `origin` was not set to `\"*\"`. Since `Vary` is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling.\n\nMost environments will see impact only when shared caches or proxies rely on the `Vary` header. The practical effect varies by configuration.\n\n### Impact \nMay cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations. \n\n### Resolution \nUpdate to the latest patched release. The CORS middleware has been corrected to handle `Vary` exclusively as a response header.",
"id": "GHSA-q7jf-gf43-6x6p",
"modified": "2025-11-27T08:51:26Z",
"published": "2025-10-24T19:15:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-q7jf-gf43-6x6p"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/commit/d9b8b4b73b4f997994f2764013207365fe711282"
},
{
"type": "PACKAGE",
"url": "https://github.com/honojs/hono"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Hono vulnerable to Vary Header Injection leading to potential CORS Bypass"
}
Mitigation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Mitigation
Use only SSL communication.
Mitigation
Terminate the client session after each request.
Mitigation
Turn all pages to non-cacheable.
CAPEC-273: HTTP Response Smuggling
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
See CanPrecede relationships for possible consequences.
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.